UK Websites Were Hacked to Mine Cryptocurrency

BY SHACK15 - 15 February, 2018

Websites across Britain have been commandeered by hackers and used to mine cryptocurrency, a security expert discovered.

The websites under attack, which included those belonging to the NHS and to the Information Commissioner’s Office (ICO), were among over 4,000 “cryptojacked” websites all around the globe, as revealed by cybersecurity researcher Scott Helme; they were subsequently taken down once the news of the hack broke.

The more I think about this the worse it becomes. Attackers had arbitrary script injection on thousands of sites including many NHS websites here in England. Just stop and think for a few moments about what exactly they could have done with that capability… 😱

According to The Register, it seems that all the websites affected by the attack had installed Browsecloud, a plugin developers by UK company Texthelp, that allows visually impaired people to access and navigate a website.

The hackers managed to compromise the plugin and use it as a point-of-entry, modifying its script in order to add code that exploited the websites’ computing power to mine cryptocurrency Monero.

Texthelp issued a statement on the incident, saying an investigation on the incident was under way.

“In light of other recent cyber attacks all over the world, we have been preparing for such an incident for the last year and our data security action plan was actioned straight away,” company CTO Martin McKay said.

“Texthelp has in place continuous automated security tests for Browsealoud, and these detected the modified file and as a result the product was taken offline.”